← Home

@defuse-protocol/intents-sdk

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

cawabunga_aurora

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:omni-bridge-sdk AI (phantom-deps): omni-bridge-sdk is a declared dependency used via config/re-export pattern; stable false positive for this package. ai
publish-pattern new-deps-added AI (publish-pattern): New deps are established ecosystem packages (solana/web3.js, valibot, etc.) consistent with multi-chain SDK expansion. ai
source-diff large-new-source-files AI (source-diff): SDK bundles chain-specific deps (Solana, NEAR) into dist/node_modules; large file counts are expected for this package. ai
source-diff source-size-tripled AI (source-diff): Size growth driven by bundled @solana/web3.js and related libs; consistent with expanding multi-chain SDK scope. ai
provenance no-provenance AI (provenance): Established package with 108 versions; provenance not historically used, low risk. ai
maintainer-change maintainer-removed AI (maintainer-change): Removal of human maintainer consistent with migration to automated CI/CD publishing via GitHub Actions. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publishing with SLSA attestation is a legitimate and more secure publishing pattern for this org. ai
phantom-deps phantom-dep:@near-js/keystores AI (phantom-deps): NEAR SDK deps referenced in config/type files; stable false positive for this package. ai
phantom-deps phantom-dep:@near-js/accounts AI (phantom-deps): NEAR SDK deps referenced in config/type files; stable false positive for this package. ai
phantom-deps phantom-dep:@near-js/client AI (phantom-deps): NEAR SDK deps referenced in config/type files; stable false positive for this package. ai
phantom-deps phantom-dep:@lifeomic/attempt AI (phantom-deps): @lifeomic/attempt is a declared runtime dep; phantom-dep heuristic fires incorrectly for bundled SDK packages. ai

Versions (showing 51 of 89)

View all versions
Version Deps Published
0.75.0 16 / 2
0.74.1 16 / 2
0.74.0 16 / 2
0.73.0 16 / 2
0.72.0 16 / 2
0.71.0 16 / 2
0.70.0 16 / 2
0.69.1 16 / 2
0.69.0 16 / 2
0.68.1 16 / 2
0.68.0 16 / 2
0.67.2 16 / 2
0.67.1 16 / 2
0.67.0 16 / 2
0.66.1 16 / 2
0.66.0 16 / 2
0.65.0 16 / 2
0.64.1 16 / 2
0.64.0 16 / 1
0.63.2 16 / 1
0.63.1 16 / 1
0.63.0 16 / 1
0.62.2 16 / 1
0.62.1 16 / 1
0.62.0 16 / 1
0.61.0 16 / 1
0.60.0 16 / 1
0.59.1 16 / 1
0.59.0 16 / 1
0.58.2 16 / 1
0.58.1 16 / 1
0.58.0 16 / 1
0.57.0 16 / 1
0.56.1 16 / 1
0.56.0 16 / 1
0.55.1 16 / 1
0.55.0 16 / 1
0.54.0 16 / 1
0.53.3 16 / 1
0.53.2 16 / 1
0.53.1 16 / 1
0.53.0 16 / 1
0.52.0 16 / 1
0.51.0 16 / 1
0.50.0 16 / 1
0.49.0 18 / 1
0.48.0 18 / 1
0.47.0 18 / 1
0.46.0 18 / 1
0.45.0 18 / 1
0.44.0 18 / 1

v0.75.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.74.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.74.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.73.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.